Roundcube Webmail versions prior to 1.6.17 and any 1.7.x release before 1.7.2 contain a stored cross‑site scripting flaw. The vulnerability stems from the attachment‑validation warning page not escaping the MIME type of uploaded attachments. An attacker who can upload an attachment with a crafted MIME type can embed JavaScript that is executed when a recipient views the warning page, potentially allowing session hijacking, data theft, or phishing redirects. This is an instance of improper input sanitization (CWE‑79).

The affected software is Roundcube Webmail. All deployments running version 1.6.x earlier than 1.6.17 or 1.7.x earlier than 1.7.2 are environments that rely on these legacy releases remain exposed until upgraded.

The CVSS score of 4.7 indicates moderate severity. The EPSS score of less than 1 % implies low current the vulnerability is not listed in CISA KEV. The attack vector is inferred to require authenticated uploading of a malicious attachment and subsequent viewership of the warning page; there is no remote unauthenticated exploitation. Even with low prevalence, stored XSS poses a considerable risk to confidentiality, integrity, and possibly availability if attackers divert of service in the browser on affected clients.